for running CLI commands and validating configurations directly. All guidance also works with standard AWS CLI.
Critical Warnings
CodeConnections PENDING trap
Connections created via CLI/CloudFormation remain
PENDING
indefinitely — MUST complete OAuth in the AWS Console. No API-only path exists.
Cross-account triple requirement
Cross-account deploys need ALL THREE: (1) KMS key policy granting target account (use key ID, not alias), (2) S3 bucket policy for target account, (3) cross-account IAM role with trust policy. Missing any one = cryptic
Access Denied
.
CodeDeploy ApplicationStop uses PREVIOUS revision
Broken stop scripts in a prior deployment block ALL future deploys. Make stop scripts idempotent (exit 0 if service absent). Unblock with
--ignore-application-stop-failures
.
CodeBuild VPC without NAT
Builds in VPC subnets without NAT gateway hang at
DOWNLOAD_SOURCE
silently. Private subnets MUST have NAT gateway or VPC endpoints.
CodeConnections IAM
Use
codeconnections:
prefix for API calls and IAM policy Actions. Resource ARNs must match exactly — new resources use
codeconnections
prefix, existing resources may use
codestar-connections
prefix. Specify both in Resource if you have mixed-age resources.
UseConnection is over-permissive
:
codeconnections:UseConnection
grants access to ALL repositories the connection can reach. MUST specify condition keys (
codeconnections:FullRepositoryId
,
codeconnections:ProviderAction
,
codeconnections:BranchName
) to limit CodeBuild to only the required repository.
How These Services Compose
Show more
Installs
787
Repository
aws/agent-toolk…-for-aws
GitHub Stars
2.1K
First Seen
14 days ago
Security Audits
Gen Agent Trust Hub
Pass
Socket
Pass
Snyk
Pass